CVE-2019-13967

iTop 2.2.0 through 2.6.0 allows remote attackers to cause a denial of service application outage via many requests to launch a compile operation. The requests use the pages/exec.php?execenv=production&execmodule=itop-hub-connector&execpage=ajax.php&operation=compile URI. This only affects the...

Security Bulletin: Information Disclosure Security Vulnerability Affects IBM Sterling File Gateway (CVE-2018-1470, CVE-2017-1544, CVE-2017-1575)

Summary Information disclosure security vulnerability affects IBM Sterling Filegateway. Vulnerability Details CVEID: CVE-2018-1470 DESCRIPTION: IBM Sterling File Gateway could allow a remote authenticated attacker to obtain sensitive information displayed in the URL that could lead to further...

Huawei EulerOS: Security Advisory for openjpeg (EulerOS-SA-2019-2503)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2009-3552

In RHEV-M VDC 2.2.0, the SSL certificate validation was not performed when using the client-side Red Hat Enterprise Virtualization Manager interface (a WPF-based browser app) to connect to the manager. This allows a local-network attacker to conduct a man-in-the-middle, potentially fooling users ...

Fedora 29 : mingw-libidn2 (2019-a8d35fcf7c)

Libidn 2.2.0 released 2019-05-23 ================================== - Perform A-Label roundtrip for lookup functions by default - Stricter check of input to punycode decoder - Fix punycode decoding with no ASCII chars but given delimiter - Fix idn2 --no-tr64 was a no-op - Allow as a basic code...

Fedora 30 : mingw-libidn2 (2019-d3221d69e0)

Libidn 2.2.0 released 2019-05-23 ================================== - Perform A-Label roundtrip for lookup functions by default - Stricter check of input to punycode decoder - Fix punycode decoding with no ASCII chars but given delimiter - Fix idn2 --no-tr64 was a no-op - Allow as a basic code...

Incorrect Access Control vulnerability in api-platform/core

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability...

GHSA-974J-WJXX-WGGJ Incorrect Access Control vulnerability in api-platform/core

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability...

EZAutomation EZ Touch Editor

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: EZAutomation Equipment: EZ Touch Editor Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute code under the privileges of the...

CVE-2019-15701

BloodHound 2.2.0 is affected by a remote OS command injection in components/Modals/HelpModal.jsx. An attacker can exploit it via the search autocomplete after importing data from an Active Directory with a GPO whose name contains JavaScript, by spawning a child process as the current user. CVSSv3...

BloodHound Operating System Command Injection Vulnerability

BloodHound is a JavaScript application that reveals hidden relationships and attack paths in Active Directory environments through graph theory. An operating system command injection vulnerability exists in the components/Modals/HelpModal.jsx file in BloodHound version 2.2.0, which can be exploit...

exempi security update

2.2.0-9 - Fix CVE-2017-18233 resolves: 1574865 - Fix CVE-2017-18234 resolves: 1656011 - Fix CVE-2017-18236 resolves: 1574905 - Fix CVE-2017-18238 resolves: 1572270 - Fix CVE-2018-7730 resolves: 1572631...

PT-2019-13141 · Nats · Nats Server

Name of the Vulnerable Software and Affected Versions: NATS Server versions prior to 2.2.0 Description: The issue is caused by an integer overflow that allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, the attacker must first authenticate. Th...

TronLink Wallet Trust Management Issues Vulnerability

TronLink Wallet is a cryptocurrency wallet application. A trust management issue vulnerability exists in TronLink Wallet version 2.2.0, which can be exploited to read and use a user's keystore to gain unauthorized access with /data/data/com.tronlink.wallet/sharedprefs/.xml...

CVE-2019-13098

The user password via the registration form of TronLink Wallet 2.2.0 is stored in the log when the class CreateWalletTwoActivity is called. Other authenticated users can read it in the log later. The logged data can be read using Logcat on the device. When using platforms prior to Android 4.1 Jel...

CVE-2018-20851

Helpy before 2.2.0 allows agents to edit admins...

CVE-2018-20851

Helpy before 2.2.0 allows agents to edit admins...

UBUNTU-CVE-2019-10183

Virt-install1 utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option accepts guest VM password as command line arguments, thus leaking them to others users on the system via process listing. It was introduced...

Debian: Security Advisory (DSA-4472-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4472-1] expat security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4472-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 28, 2019 https://www.debian.org/security/faq -...